Public keys are useless off-domain: patterns, wildcards, and the rules that refuse to widen.
Updated
A public key must present a browser Origin matching one of its active patterns, over HTTPS. Secret keys are server-side and carry no browser origin, so they skip the check entirely — which is exactly why they must never reach a browser.
dashfordevs.com exact host
https://dashfordevs.com scheme is stripped; still an exact host
*.dashfordevs.com the domain and any subdomain
localhost local development
A bare * is rejected: an allowlist that allows everything is not an allowlist. Patterns are normalized on every write — not just through forms — because a pattern that skipped validation would silently widen access.
Refusals name their reason — live keys require HTTPS; the Origin header is required; no allowed origins configured; origin not allowed for this key. The request log records the origin on every call, so allowlist problems are debugged by reading the trail, not by guessing.
Flipping a platform to live mode is refused if a public key has no allowed origin — otherwise that key would start failing everywhere the moment you switched.